tPj1UdZddlmZddlmZmZmZmZddlm Z ddl m Z ddl m Z ddlmZddlmZmZdd lmZmZdd lmZmZmZer dd lmZdd lmZd Zeed<eddhZ eed<de!dzde"fdZ#Gdde Z$y)z Security hook to prevent user B from seeing response from user A. This hook uses the DBSpendUpdateWriter to batch-write response IDs to the database instead of writing immediately on each request. )AsyncGenerator) TYPE_CHECKINGAnyFinalcast) HTTPException)verbose_proxy_logger) CustomLogger)LitellmUserRoles)decrypt_value_helperencrypt_value_helper)BaseLiteLLMOpenAIResponseObjectResponsesAPIResponse)CallTypesLiteralLLMResponseTypes SpecialEnums) DualCache)UserAPIKeyAuthz/openai_RESPONSES_API_PROVIDER_PREFIXz /v1/responsesz /responses_RESPONSES_API_CREATE_ROUTES request_routeNreturncp|y|jtdzr|ttdn|}|tvS)NF/) startswithrlenr)r canonicals n/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/hooks/responses_id_security.py_is_responses_api_create_router#sJ  # #$BS$H I c89;<  4 44c eZdZdZdddddededeezezd zf d Zd ed zd ed zddde fd Z dede fdZ dede eed zed zffdZ ded zfdZ ddedddeeefd zdefdZdedddedefdZdddededeed ffdZy )ResponsesIDSecuritycyN)selfs r__init__zResponsesIDSecurity.__init__/s r user_api_key_dictrcacherdata call_typerNczKhd}||vry|dk(rS|jd}|r>|j|r-|j|\}}} |j|| |||d<|S|dvrQ|jd} | r>|j| r-|j| \}}} |j|| |||d<|Sw)N> aresponsesaget_responsesacancel_responsesadelete_responsesalist_input_itemsr-previous_response_id>r.r/r0r1 response_id)get_is_encrypted_response_id_decrypt_response_id check_user_access_to_response_id) r&r(r)r*r+responses_api_call_typesr2original_response_iduser_idteam_idr3s rasync_pre_call_hookz'ResponsesIDSecurity.async_pre_call_hook2s+   4 4  $*.((3I*J #(F(FG[(\9=9R9RSg9h6$gw55gwHYZ/C+, k k!%-!8Kt==kJ9=9R9RS^9_6$gw55gwHYZ&:]# sB9B;response_id_user_idresponse_id_team_idcddlm}|jtjj k(s|jtjk(ry|rP||j k7rA|jddr"tjd|j |ytdd |r[||jk7rL|jddr-tjd ||j |jytdd y) Nrgeneral_settingsTdisable_responses_id_securityFziResponses ID Security is disabled. User %s is accessing response id %s which is not associated with them.izForbidden. The response id is not associated with the user, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file.) status_codedetailzkResponses ID Security is disabled. Response belongs to team %s but user %s is accessing it with team id %s.zForbidden. The response id is not associated with the team, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file.) litellm.proxy.proxy_serverrA user_roler PROXY_ADMINvaluer:r4r debugrr;)r&r=r>r(rAs rr7z4ResponsesIDSecurity.check_user_access_to_response_idTs @  ' '+;+G+G+M+M M **.>.J.JJ #6:K:S:S#S##$CUK$**%--' e  #6:K:S:S#S##$CUK$**B'%--%--  e  r r3c|jd}t|dkry|d}t|dd}|y|jtj j ryy)Nresp_Fr3TrHkeyreturn_original_valuesplitrr rrLITELM_MANAGED_FILE_ID_PREFIXrH)r&r3 split_resultremaining_stringdecrypted_values rr5z-ResponsesIDSecurity._is_encrypted_response_idse)//8 | q ".q/.5E=ptu  "  % %l&P&P&V&V Wr c|jd}t|dkr|ddfS|d}t|dd}||ddfS|jtj j rt|jd}t|dk\rP|d }|jd d }|d}|jd d } |d} | jd d } || | fS|ddfS|ddfS)z Returns: - original_response_id: the original response id - user_id: the user id - team_id: the team id rKrLNrMr3TrN;rz response_id:zuser_id:zteam_id:rQ) r&r3rTrUrVpartsresponse_id_partr9 user_id_partr: team_id_partr;s rr6z(ResponsesIDSecurity._decrypt_response_ids*//8 | q d* *".q/.5E=ptu  "d* *  % %l&P&P&V&V W*005E5zQ*/( .>.D.D^.TUW.X$',Ah !-!3!3J!?!C',Ah !-!3!3J!?!C+Wg==#D$..D$&&r cFddl}ddlm}|jdd}||}|S)z.Get the signing key for encryption/decryption.rN) master_keyLITELLM_SALT_KEY)osrEr_getenv)r&rar_salt_keys r_get_signing_keyz$ResponsesIDSecurity._get_signing_keys)999/6  !Hr response request_cachecr|j}|tjd|St|dd}t|dd}|rt |t r|j dr|||vrt|d|||Stjjj||jxsd|jxsd}t|}d|} || ||<t|d| |S|rt |tr|)|j |vrt|d||j ntjjj|j |jxsd|jxsd}t|}d|} || ||j <t|d| t|d||S)NzResponse ID encryption is enabled but no signing key is configured. Please set LITELLM_SALT_KEY environment variable or configure a master_key. Skipping response ID encryption. See: https://docs.litellm.ai/docs/proxy/prod#5-set-litellm-salt-keyidrerK)rH)rdr rIgetattr isinstancestrrsetattrr5LITELLM_MANAGED_RESPONSE_API_RESPONSE_ID_COMPLETE_STRrHformatr:r;r rrh) r&rer(rf signing_keyr3 response_objencrypted_response_idencoded_user_id_and_response_id encrypted_ids r_encrypt_response_idz(ResponsesIDSecurity._encrypt_response_ids"224   & &V  O$XtT: %h DA :k37KY8Z&'P #* 04 818,8CH~, 8 ) 8t,#  .!1=@PT 7= >r r")%__doc__collections.abcrtypingrrrrfastapirlitellm._loggingr "litellm.integrations.custom_loggerr litellm.proxy._typesr 0litellm.proxy.common_utils.encrypt_decrypt_utilsr r litellm.types.llms.openairrlitellm.types.utilsrrrlitellm.caching.cachingrrr__annotations__ frozensetrrlrrr"r%r rrs+22!1;1QP13)21&/,0O&PeP5#*55s,sr